For moving laterally from a low-priv Windows account, which tool category is the MOST appropriate to use while staying stealthy?

• A. Netcat
• B. Nmap
• C. Living Off the Land Binaries (LOLbins)
• D. Metasploit

Answer: (C)

Using Living Off the Land Binaries to move laterally from a low-priv Windows account relies on blending with normal administrative activity by leveraging built-in, trusted binaries. These binaries are part of the OS and are already whitelisted in many security controls, so they can be used to perform essential tasks like remote command execution, file transfers, or script execution without introducing new, clearly identifiable tooling. That lower footprint makes it easier to operate stealthily, since defenders expect legitimate binaries to be in use and their activity often appears routine rather than suspicious.

In practice, you can use these built-in tools to reach other machines, run commands, or pull payloads without deploying external frameworks. Metasploit or Nmap, on the other hand, introduce unfamiliar software and behavior that tends to trigger detections or raise red flags, while Netcat can be considered an unusual or blocked utility in many environments. So the category that best supports stealthy, low-priv lateral movement is the Living Off the Land Binaries approach.